CVE-2021-40491

Published: Sep 3, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476

https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd

https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html

[debian-lts-announce] 20221125 [SECURITY] [DLA 3205-1] inetutils security update

mailing-list

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2021-40491

Description

Affected Products

References